Extracted

• • Target
    RFQ-02-ORDER.xlsm
  • Size 52KB
  • SHA256 5162d67fe571a80e9b1dc7683a99b491d09e512639a09f853caec76a9861abe6
  • MD5 4e777e79157f87ee0ba9cb80e4f8fcda
  • SHA1 9219b3a8a4de3a2aaea94b6485096dd1a3704a72
  • SHA512 57d08e69de829d53c8cd8711378ef16bcc283bc36a0469598e14b641144fa8db54dca618ce47c3deada3ebe73c01027bf7d9e1c82da2960674309ceed4b85bfb
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2